hailin
816c5461f9
在 platform_admin 之上新增 platform_super_admin 角色，实现平台管理员的两级权限体系。
## 角色层级
platform_super_admin > platform_admin > admin > operator > viewer
- platform_super_admin：最高平台权限，含所有 platform_admin 操作 + 破坏性操作（删除租户/用户/版本）
- platform_admin：日常平台运营，可查看/编辑租户、管理 App 版本、配置账单套餐，不可执行删除
## 变更明细
### auth-service — role-type.vo.ts
- 新增 RoleType.PLATFORM_SUPER_ADMIN = 'platform_super_admin'
### auth-service — tenant.controller.ts
- 租户列表/创建/查看/编辑：@Roles('platform_admin', 'platform_super_admin')（两级均可）
- 删除租户 DELETE /:id：@Roles('platform_super_admin')（仅超管）
### auth-service — user.controller.ts
- 类级别：@Roles('platform_admin', 'platform_super_admin')（两级均可访问用户列表/创建/编辑）
- 删除用户 DELETE /:id：@Roles('platform_super_admin')（仅超管）
### version-service — guards/platform-admin.guard.ts
- 更新：接受 platform_admin 或 platform_super_admin 任一角色
- 重构：抽取 decodeJwtRoles() 工具函数，供 PlatformSuperAdminGuard 复用
### version-service — guards/platform-super-admin.guard.ts（新文件）
- 仅接受 platform_super_admin 角色
- 与 PlatformAdminGuard（类级别）叠加使用，实现方法级别的超管限制
### version-service — version.controller.ts
- DELETE /:id：叠加 @UseGuards(PlatformSuperAdminGuard)（仅超管可删除版本文件）
### web-admin — sidebar.tsx
- isPlatformAdmin 检测同时涵盖 platform_admin 和 platform_super_admin
- 两级平台管理员均显示相同侧边栏菜单
## 升级现有账号为 platform_super_admin
UPDATE public.users SET roles = '{platform_super_admin}' WHERE email = 'xxx@xxx.com';
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
|
||
|---|---|---|
| deploy | ||
| docs | ||
| it0-web-admin | ||
| it0_app | ||
| packages | ||
| .dockerignore | ||
| .env.example | ||
| .gitignore | ||
| Dockerfile.service | ||
| README.md | ||
| entrypoint.sh | ||
| logo.svg | ||
| package.json | ||
| pnpm-lock.yaml | ||
| pnpm-workspace.yaml | ||
| tsconfig.base.json | ||
| turbo.json | ||
README.md
IT0 — AI-Powered Server Cluster Operations Platform
Intelligent operations platform that combines AI agents with human oversight for managing server clusters.
Architecture
- Backend: NestJS microservices (TypeScript) with DDD + Clean Architecture
- Mobile: Flutter app with Riverpod state management
- Web Admin: Next.js dashboard with Zustand + React Query
- Voice: Python service for voice-based interaction (STT/TTS/VAD)
Services
| Service | Description |
|---|---|
| auth-service | Authentication, RBAC, API key management |
| agent-service | AI agent orchestration (Claude CLI + API) |
| inventory-service | Server, cluster, credential management |
| monitor-service | Metrics collection, alerting, health checks |
| ops-service | Task execution, approvals, standing orders |
| comm-service | Multi-channel notifications, escalation |
| audit-service | Audit logging, compliance trail |
| voice-service | Voice pipeline (Python) |
Quick Start
# Backend
pnpm install
pnpm dev
# Flutter
cd it0_app && flutter pub get && flutter run
# Web Admin
cd it0-web-admin && pnpm install && pnpm dev
Tech Stack
- Runtime: Node.js 20+, Dart 3.x, Python 3.11+
- Database: PostgreSQL (schema-per-tenant)
- Cache/Events: Redis Streams
- AI: Anthropic Claude (CLI + API)
- Build: pnpm workspaces + Turborepo